Alex Joseph
A significant security flaw has been identified in n8n, a popular workflow automation tool. This vulnerability could allow unauthorized individuals to interfere with your n8n test workflows. While the risk is limited to disrupting ongoing test sessions, it’s crucial for users to understand the issue and apply the necessary updates to maintain the integrity of their development environments.
The core of the problem lies in how n8n handles its test webhook registration. Before proper security checks are in place, a specific endpoint can be accessed without authentication. This means if an attacker knows a workflow’s ID, they can cancel its active test webhook, essentially halting any in-progress testing.
It’s important to note that this vulnerability does not affect your production webhooks, your permanent workflow data, or any stored information within n8n. The impact is confined to the temporary disruption of test sessions.
CVE Details
This vulnerability is officially identified as CVE-2026-65014. It affects the n8n automation platform.
- Product: n8n
- Published Date: July 22, 2026
- Severity: Medium
- Status: Analyzed
Affected Products
The security flaw impacts versions of n8n across both its community and enterprise editions, specifically those running on Node.js.
Affected versions include:
- n8n versions prior to 2.28.0
- n8n versions prior to 2.27.4 on the 2.27.x branch
Current Status
The vulnerability is currently “Analyzed.” This means the issue has been thoroughly investigated, and its characteristics and impact are well understood.
Severity Level
CVE-2026-65014 has been rated with a Medium severity. The CVSS (Common Vulnerability Scoring System) score is 5.3. This rating indicates that while the vulnerability could be exploited by an unauthenticated attacker over the network, the direct impact is limited. Attackers can disrupt test sessions by canceling webhooks, but they cannot access sensitive data or compromise the core functionality or persistent data of your n8n instance. This localized impact helps keep the severity from being higher, but it still warrants immediate attention to prevent operational disruptions during testing phases.
Possible Solutions
The good news is that fixes are available to address this vulnerability. To protect your n8n instances, it is strongly recommended to update to the patched versions as soon as possible.
The following versions include the necessary security patches:
- n8n version 2.28.0 and later
- n8n version 2.27.4 and later (for users on the 2.27.x branch)
If an immediate upgrade is not feasible, consider these temporary mitigation steps:
- Restrict Network Access: Limit direct network access to your n8n instance, ensuring only fully trusted users can reach it.
- Implement a Reverse Proxy/Firewall: Position a reverse proxy or firewall in front of your n8n instance. Configure it to enforce authentication before any requests can reach the n8n REST API.
Keep in mind that these workarounds are temporary and do not fully eliminate the risk. Prioritize upgrading to the patched versions for comprehensive protection.
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-33q9-f52j-gc75
https://www.vulncheck.com/advisories/n8n-before-authentication-bypass-via-test-webhook
